Fabric Site

Location in GUI: Provision » SD-Access » Fabric Sites

Diagram

Classes

fabric (catalyst_center)

Name	Type	Constraint	Mandatory	Default Value
fabric_sites	List	[fabric_sites]	No

fabric_sites (catalyst_center.fabric)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
authentication_template	Class	[authentication_template]	No
pub_sub_enabled	Boolean	true, false	No	false
reconfigure	Boolean	true, false	No
l3_virtual_networks	List	String	No
l2_virtual_networks	List	[l2_virtual_networks]	No
anycast_gateways	List	[anycast_gateways]	No
wireless_ssids	List	[wireless_ssids]	No
fabric_zones	List	[fabric_zones]	No
multicast	Class	[multicast]	No

authentication_template (catalyst_center.fabric.fabric_sites)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes	No Authentication
dot1x_to_mab_fallback_timeout	Integer	min: 3, max: 120	No
wake_on_lan	Boolean	true, false	No
number_of_hosts	Choice	Unlimited, Single	No
bpdu_guard	Boolean	true, false	No
authentication_order	Choice	mac, dot1x	No
pre_auth_acl	Class	[pre_auth_acl]	No

l2_virtual_networks (catalyst_center.fabric.fabric_sites)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
vlan_name	String		No
vlan_id	Integer	min: 2, max: 4093	No
traffic_type	Choice	DATA, VOICE	No
fabric_enabled_wireless	Boolean	true, false	No
associated_l3_virtual_network_name	String		No

anycast_gateways (catalyst_center.fabric.fabric_sites)

Name	Type	Constraint	Mandatory	Default Value
ip_pool_name	String		Yes
pool_type	Any	Choice[EXTENDED_NODE, FABRIC_AP] or Null	No
auto_generate_vlan_name	Boolean	true, false	No	false
vlan_name	String		No
vlan_id	Integer	min: 2, max: 4093	No
security_group_name	String		No
ip_directed_broadcast	Boolean	true, false	No	false
intra_subnet_routing_enabled	Boolean	true, false	No	false
multiple_ip_to_mac_addresses	Boolean	true, false	No	false
supplicant_based_extended_node_onboarding	Boolean	true, false	No
group_based_policy_enforcement_enabled	Boolean	true, false	No
layer2_flooding	Boolean	true, false	No	false
traffic_type	Choice	DATA, VOICE	No	DATA
critical_pool	Boolean	true, false	No	false
wireless_pool	Boolean	true, false	No	false
tcp_mss_adjustment	Integer	min: 500, max: 1440	No
l3_virtual_network	String		No

wireless_ssids (catalyst_center.fabric.fabric_sites)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
vlan_name	String		Yes

fabric_zones (catalyst_center.fabric.fabric_sites)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
authentication_template	Class	[authentication_template]	No
l3_virtual_networks	List	String	No
anycast_gateways	List	String	No
l2_virtual_networks	List	String	No

multicast (catalyst_center.fabric.fabric_sites)

Name	Type	Constraint	Mandatory	Default Value
replication_mode	Choice	NATIVE_MULTICAST, HEADEND_REPLICATION	No
wireless_multicast_enabled	Boolean	true, false	No
virtual_networks	List	[virtual_networks]	No

pre_auth_acl (catalyst_center.fabric.fabric_sites.authentication_template)

Name	Type	Constraint	Mandatory	Default Value
enabled	Boolean	true, false	No
implicit_action	Choice	DENY, PERMIT	No
description	String		No
access_contracts	List	[access_contracts]	No

virtual_networks (catalyst_center.fabric.fabric_sites.multicast)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
ip_pool_name	String		Yes
ipv4_ssm_ranges	List	String	No
multicast_rps	List	[multicast_rps]	No

access_contracts (catalyst_center.fabric.fabric_sites.authentication_template.pre_auth_acl)

Name	Type	Constraint	Mandatory	Default Value
action	Choice	PERMIT, DENY	Yes
port	Choice	domain, bootpc, bootps	Yes
protocol	Choice	TCP, UDP, TCP_UDP	Yes

multicast_rps (catalyst_center.fabric.fabric_sites.multicast.virtual_networks)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
rp_location	Choice	FABRIC, EXTERNAL	Yes
ipv4_address	IP		No
ipv6_address	IP		No
is_default_v4_rp	Boolean	true, false	No
is_default_v6_rp	Boolean	true, false	No
fabric_rps	List	String	No
ipv4_asm_ranges	List	String	No
ipv6_asm_ranges	List	String	No

Fabric Sites define the SD-Access fabric boundary within the site hierarchy. Enabling a site as a fabric site activates Software-Defined Access functionality including micro-segmentation, policy enforcement, and automated underlay/overlay provisioning. Fabric sites contain Border Devices, Virtual Networks, Anycast Gateways, and Port Assignments. This resource is SDA fabric only.

Examples

Example-1: Basic Fabric Site with No Authentication

This example demonstrates how to configure a basic SD-Access fabric site in Catalyst Center with no authentication requirements. Fabric sites enable Software-Defined Access functionality within designated network areas, providing centralized policy enforcement and micro-segmentation capabilities.

The fabric site configuration includes:

• Site hierarchy specification (Global/Canada) for geographic and organizational structure
• Authentication template assignment (No Authentication) for simplified initial deployment
• Foundation for SD-Access fabric enablement without immediate authentication requirements
• Base configuration suitable for proof-of-concept or laboratory environments

---
catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Canada
        authentication_template:
          name: No Authentication
        pub_sub_enabled: true

Example-2: Campus Fabric Site with Closed Authentication

This example demonstrates how to configure a campus fabric site with closed authentication mode for high-security environments where all network access requires explicit authentication and authorization.

---
catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Canada
        authentication_template:
          name: Closed Authentication
        pub_sub_enabled: true

Example-3: Multi-Site Fabric Deployment

This example shows how to configure multiple fabric sites across different geographic locations, each with appropriate authentication templates based on local security requirements and organizational policies.

---
catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/North_America/New_York_Office
        authentication_template:
          name: Closed Authentication
        pub_sub_enabled: true


      - name: Global/Asia_Pacific/Tokyo_Branch
        authentication_template:
          name: Open Authentication
        pub_sub_enabled: true

      - name: Global/Europe/London_Office
        authentication_template:
          name: Low Impact
        pub_sub_enabled: true


      - name: Global/Americas/Mexico_City_Branch
        authentication_template:
          name: No Authentication
        pub_sub_enabled: true

Example-4: Fabric Site custom authentication template

This example demonstrates how to configure a fabric site with custom options for authentication templates

---
catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Corporate/London_Office
        authentication_template:
          name: Closed Authentication
          dot1x_to_mab_fallback_timeout: 30
          wake_on_lan: false
          number_of_hosts: Unlimited
          authentication_order: dot1x
          bpdu_guard: false
        pub_sub_enabled: true


     - name: Global/Corporate/Tokyo_Branch
        authentication_template:
        authentication_template:
          name: Low Impact
          dot1x_to_mab_fallback_timeout: 30
          wake_on_lan: false
          number_of_hosts: Unlimited
          authentication_order: mac
          bpdu_guard: false
          pre_auth_acl:
            enabled: true
            implicit_action: PERMIT
            access_contracts:
              - action: PERMIT
                port: domain
                protocol: UDP
              - action: PERMIT
                port: bootpc
                protocol: UDP
              - action: PERMIT
                port: bootps
                protocol: UDP
        pub_sub_enabled: true

Example-5: Fabric Site Reconfiguration

When the IPv4 pool used by a Fabric site is modified, for example when DHCP or DNS server information is updated, the Fabric becomes out of date. The site must be re-provisioned so that the changes take effect.

Cisco Catalyst Center displays a warning on the Fabric site indicating that a reconfiguration is required.

Caution

You modified the IP pools used by this Fabric. The Fabric is now out of date. To update, select Reconfigure Fabric. The update time depends on the number of devices. To trigger the reconfiguration through the Data Model, add the field “reconfigure: true” under the Fabric site configuration.

---
catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Poland/Krakow
        reconfigure: true

Example-6: Fabric Site configuration with fabric zones

This example demonstrates how to configure a fabric site that has a fabric zone

Note

This is a greenfield deployment: the Fabric Site and its Fabric Zone are created together in a single configuration. For converting an existing (brownfield) Fabric Site into a Fabric Zone, refer to Example-7.

Caution

In the devices yaml file, the Edge device that will be part of the fabric zone, is configured with a fabric_zone element matching the fabric zone name

---
catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Poland/Bytom
        authentication_template:
          name: Closed Authentication
          dot1x_to_mab_fallback_timeout: 30
          wake_on_lan: false
          number_of_hosts: Unlimited
          authentication_order: dot1x
        pub_sub_enabled: false
        l2_virtual_networks:
          - name: L2_SDA_VN_1
            vlan_name: L2_VLAN_USERS
            vlan_id: 455
            traffic_type: DATA
            fabric_enabled_wireless: false
          - name: L2_VN
            vlan_name: L2VN_VLAN
            traffic_type: DATA
            fabric_enabled_wireless: false
        l3_virtual_networks:
          - SDA_VN_USERS
          - SDA_VN_PRINTERS
          - SDA_VN_CORPORATE
          - INFRA_VN
        anycast_gateways:
          - ip_pool_name: Campus
            vlan_name: Campus_VLAN
            traffic_type: DATA
            l3_virtual_network: SDA_VN_USERS
            wireless_pool: true
          - ip_pool_name: Voice
            vlan_name: Voice_VLAN
            vlan_id: 224
            traffic_type: VOICE
            l3_virtual_network: SDA_VN_USERS
          - ip_pool_name: AP
            pool_type: FABRIC_AP
            vlan_name: AP_VLAN
            vlan_id: 225
            traffic_type: DATA
            l3_virtual_network: INFRA_VN

        fabric_zones:
          - name: Global/Poland/Bytom/Bld_B
            authentication_template:
              name: No Authentication
            l3_virtual_networks:
              - SDA_VN_USERS
            l2_virtual_networks:
              - L2_SDA_VN_1
            anycast_gateways:
              - Campus


  inventory:
    devices:
      - name: LAN-EN2
        fqdn_name: LAN-EN2.cisco.eu
        device_ip: 181.1.1.43
        pid: C9KV-UADP-8P
        state: PROVISION
        device_role: ACCESS
        site: Global/Poland/Bytom/Bld_B
        fabric_zone: Global/Poland/Bytom/Bld_B
        fabric_roles:
          - EDGE_NODE

Example-7: Brownfield Fabric Zone Conversion

Catalyst Center supports two ways to create a Fabric Zone through the GUI:

1. Greenfield: Create the Fabric Zone during the creation of the Fabric Site.
2. Brownfield: Convert an existing Fabric Site (or move devices from an existing Fabric Site) into a Fabric Zone.

Caution

The Network as Code framework only supports seamless Fabric Zone creation for greenfield deployments (Option 1 above). A brownfield Fabric Zone conversion on a day-2 operation is a disruptive operation and must be properly planned within a maintenance window.

Why is this disruptive?

The brownfield conversion requires swapping the device’s fabric membership from a Fabric Site ID to a Fabric Zone ID (i.e. replacing the fabric_site reference with a fabric_zone reference on the device). To perform this swap safely, the existing fabric_roles must first be removed from the affected devices. Removing fabric roles also affects any associated port-assignments and port-channels on those devices, which will interrupt traffic on those interfaces until the devices are re-provisioned into the Fabric Zone.

This procedure also requires several sequential Terraform applies to complete safely, since each device must be fully removed from its current fabric role (Fabric Site ID) before being re-associated with the target Fabric Zone ID.

Steps to perform a brownfield Fabric Zone conversion:

1. Plan a maintenance window. Notify stakeholders since traffic on the affected devices’ port-assignments and port-channels will be disrupted.
2. Remove the existing fabric_roles and fabric_site from ALL devices that will become part of the location associated with the day-N Fabric Zone (commenting out or deleting these fields in the inventory data model), then run terraform apply.
3. Create the Fabric Zone under the parent Fabric Site and swap the device’s fabric_site reference for a fabric_zone reference in the inventory data model, pointing it to the target Fabric Zone name, then run terraform apply to re-provision the devices into the Fabric Zone with the desired fabric_roles.
4. Re-apply any port-assignments and port-channels that were affected by the removal of the fabric roles.
5. Validate that the devices are correctly provisioned in the target Fabric Zone and that all port-assignments and port-channels are restored and operational.

Location in GUI: Provision » SD-Access » Fabric Sites

Diagram

Classes

fabric (catalyst_center)

Name	Type	Constraint	Mandatory	Default Value
fabric_sites	List	[fabric_sites]	No

fabric_sites (catalyst_center.fabric)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
authentication_template	Class	[authentication_template]	No
pub_sub_enabled	Boolean	true, false	No	false
reconfigure	Boolean	true, false	No
l3_virtual_networks	List	String	No
l2_virtual_networks	List	[l2_virtual_networks]	No
anycast_gateways	List	[anycast_gateways]	No
wireless_ssids	List	[wireless_ssids]	No
fabric_zones	List	[fabric_zones]	No
multicast	Class	[multicast]	No

authentication_template (catalyst_center.fabric.fabric_sites)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes	No Authentication
dot1x_to_mab_fallback_timeout	Integer	min: 3, max: 120	No
wake_on_lan	Boolean	true, false	No
number_of_hosts	Choice	Unlimited, Single	No
bpdu_guard	Boolean	true, false	No
authentication_order	Choice	mac, dot1x	No
pre_auth_acl	Class	[pre_auth_acl]	No

l2_virtual_networks (catalyst_center.fabric.fabric_sites)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
vlan_name	String		No
vlan_id	Integer	min: 2, max: 4093	No
traffic_type	Choice	DATA, VOICE	No
fabric_enabled_wireless	Boolean	true, false	No
associated_l3_virtual_network_name	String		No

anycast_gateways (catalyst_center.fabric.fabric_sites)

Name	Type	Constraint	Mandatory	Default Value
ip_pool_name	String		Yes
pool_type	Any	Choice[EXTENDED_NODE, FABRIC_AP] or Null	No
auto_generate_vlan_name	Boolean	true, false	No	false
vlan_name	String		No
vlan_id	Integer	min: 2, max: 4093	No
security_group_name	String		No
ip_directed_broadcast	Boolean	true, false	No	false
intra_subnet_routing_enabled	Boolean	true, false	No	false
multiple_ip_to_mac_addresses	Boolean	true, false	No	false
supplicant_based_extended_node_onboarding	Boolean	true, false	No
group_based_policy_enforcement_enabled	Boolean	true, false	No
layer2_flooding	Boolean	true, false	No	false
traffic_type	Choice	DATA, VOICE	No	DATA
critical_pool	Boolean	true, false	No	false
wireless_pool	Boolean	true, false	No	false
tcp_mss_adjustment	Integer	min: 500, max: 1440	No
l3_virtual_network	String		No

wireless_ssids (catalyst_center.fabric.fabric_sites)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
vlan_name	String		Yes

fabric_zones (catalyst_center.fabric.fabric_sites)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
authentication_template	Class	[authentication_template]	No
l3_virtual_networks	List	String	No
anycast_gateways	List	String	No
l2_virtual_networks	List	String	No

multicast (catalyst_center.fabric.fabric_sites)

Name	Type	Constraint	Mandatory	Default Value
replication_mode	Choice	NATIVE_MULTICAST, HEADEND_REPLICATION	No
wireless_multicast_enabled	Boolean	true, false	No
virtual_networks	List	[virtual_networks]	No

pre_auth_acl (catalyst_center.fabric.fabric_sites.authentication_template)

Name	Type	Constraint	Mandatory	Default Value
enabled	Boolean	true, false	No
implicit_action	Choice	DENY, PERMIT	No
description	String		No
access_contracts	List	[access_contracts]	No

virtual_networks (catalyst_center.fabric.fabric_sites.multicast)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
ip_pool_name	String		Yes
ipv4_ssm_ranges	List	String	No
multicast_rps	List	[multicast_rps]	No

access_contracts (catalyst_center.fabric.fabric_sites.authentication_template.pre_auth_acl)

Name	Type	Constraint	Mandatory	Default Value
action	Choice	PERMIT, DENY	Yes
port	Choice	domain, bootpc, bootps	Yes
protocol	Choice	TCP, UDP, TCP_UDP	Yes

multicast_rps (catalyst_center.fabric.fabric_sites.multicast.virtual_networks)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
rp_location	Choice	FABRIC, EXTERNAL	Yes
ipv4_address	IP		No
ipv6_address	IP		No
is_default_v4_rp	Boolean	true, false	No
is_default_v6_rp	Boolean	true, false	No
fabric_rps	List	String	No
ipv4_asm_ranges	List	String	No
ipv6_asm_ranges	List	String	No

Fabric Sites define the SD-Access fabric boundary within the site hierarchy. Enabling a site as a fabric site activates Software-Defined Access functionality including micro-segmentation, policy enforcement, and automated underlay/overlay provisioning. Fabric sites contain Border Devices, Virtual Networks, Anycast Gateways, and Port Assignments. This resource is SDA fabric only.

Examples

Example-1: Basic Fabric Site with No Authentication

This example demonstrates how to configure a basic SD-Access fabric site in Catalyst Center with no authentication requirements. Fabric sites enable Software-Defined Access functionality within designated network areas, providing centralized policy enforcement and micro-segmentation capabilities.

The fabric site configuration includes:

• Site hierarchy specification (Global/Canada) for geographic and organizational structure
• Authentication template assignment (No Authentication) for simplified initial deployment
• Foundation for SD-Access fabric enablement without immediate authentication requirements
• Base configuration suitable for proof-of-concept or laboratory environments

---
catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Canada
        authentication_template:
          name: No Authentication
        pub_sub_enabled: true

Example-2: Campus Fabric Site with Closed Authentication

This example demonstrates how to configure a campus fabric site with closed authentication mode for high-security environments where all network access requires explicit authentication and authorization.

---
catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Canada
        authentication_template:
          name: Closed Authentication
        pub_sub_enabled: true

Example-3: Multi-Site Fabric Deployment

This example shows how to configure multiple fabric sites across different geographic locations, each with appropriate authentication templates based on local security requirements and organizational policies.

---
catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/North_America/New_York_Office
        authentication_template:
          name: Closed Authentication
        pub_sub_enabled: true


      - name: Global/Asia_Pacific/Tokyo_Branch
        authentication_template:
          name: Open Authentication
        pub_sub_enabled: true

      - name: Global/Europe/London_Office
        authentication_template:
          name: Low Impact
        pub_sub_enabled: true


      - name: Global/Americas/Mexico_City_Branch
        authentication_template:
          name: No Authentication
        pub_sub_enabled: true

Example-4: Fabric Site custom authentication template

This example demonstrates how to configure a fabric site with custom options for authentication templates

---
catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Corporate/London_Office
        authentication_template:
          name: Closed Authentication
          dot1x_to_mab_fallback_timeout: 30
          wake_on_lan: false
          number_of_hosts: Unlimited
          authentication_order: dot1x
          bpdu_guard: false
        pub_sub_enabled: true


     - name: Global/Corporate/Tokyo_Branch
        authentication_template:
        authentication_template:
          name: Low Impact
          dot1x_to_mab_fallback_timeout: 30
          wake_on_lan: false
          number_of_hosts: Unlimited
          authentication_order: mac
          bpdu_guard: false
          pre_auth_acl:
            enabled: true
            implicit_action: PERMIT
            access_contracts:
              - action: PERMIT
                port: domain
                protocol: UDP
              - action: PERMIT
                port: bootpc
                protocol: UDP
              - action: PERMIT
                port: bootps
                protocol: UDP
        pub_sub_enabled: true

Example-5: Fabric Site configuration with fabric zones

This example demonstrates how to configure a fabric site that has a fabric zone

Caution

In the devices yaml file, the Edge device that will be part of the fabric zone, is configured with a fabric_zone element matching the fabric zone name

---
catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Poland/Bytom
        authentication_template:
          name: Closed Authentication
          dot1x_to_mab_fallback_timeout: 30
          wake_on_lan: false
          number_of_hosts: Unlimited
          authentication_order: dot1x
        pub_sub_enabled: false
        l2_virtual_networks:
          - name: L2_SDA_VN_1
            vlan_name: L2_VLAN_USERS
            vlan_id: 455
            traffic_type: DATA
            fabric_enabled_wireless: false
          - name: L2_VN
            vlan_name: L2VN_VLAN
            traffic_type: DATA
            fabric_enabled_wireless: false
        l3_virtual_networks:
          - SDA_VN_USERS
          - SDA_VN_PRINTERS
          - SDA_VN_CORPORATE
          - INFRA_VN
        anycast_gateways:
          - ip_pool_name: Campus
            vlan_name: Campus_VLAN
            traffic_type: DATA
            l3_virtual_network: SDA_VN_USERS
            wireless_pool: true
          - ip_pool_name: Voice
            vlan_name: Voice_VLAN
            vlan_id: 224
            traffic_type: VOICE
            l3_virtual_network: SDA_VN_USERS
          - ip_pool_name: AP
            pool_type: FABRIC_AP
            vlan_name: AP_VLAN
            vlan_id: 225
            traffic_type: DATA
            l3_virtual_network: INFRA_VN

        fabric_zones:
          - name: Global/Poland/Bytom/Bld_B
            authentication_template:
              name: No Authentication
            l3_virtual_networks:
              - SDA_VN_USERS
            l2_virtual_networks:
              - L2_SDA_VN_1
            anycast_gateways:
              - Campus


  inventory:
    devices:
      - name: LAN-EN2
        fqdn_name: LAN-EN2.cisco.eu
        device_ip: 181.1.1.43
        pid: C9KV-UADP-8P
        state: PROVISION
        device_role: ACCESS
        site: Global/Poland/Bytom/Bld_B
        fabric_zone: Global/Poland/Bytom/Bld_B
        fabric_roles:
          - EDGE_NODE

Example-6: Fabric Site Reconfiguration

When the IPv4 pool used by a Fabric site is modified, for example when DHCP or DNS server information is updated, the Fabric becomes out of date. The site must be re-provisioned so that the changes take effect.

Cisco Catalyst Center displays a warning on the Fabric site indicating that a reconfiguration is required.

Caution

You modified the IP pools used by this Fabric. The Fabric is now out of date. To update, select Reconfigure Fabric. The update time depends on the number of devices. To trigger the reconfiguration through the Data Model, add the field “reconfigure: true” under the Fabric site configuration.

---
catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Poland/Krakow
        reconfigure: true

Location in GUI: Provision » SD-Access » Fabric Sites

Diagram

Classes

fabric (catalyst_center)

Name	Type	Constraint	Mandatory	Default Value
fabric_sites	List	[fabric_sites]	No

fabric_sites (catalyst_center.fabric)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
authentication_template	Class	[authentication_template]	No
pub_sub_enabled	Boolean	true, false	No	false
reconfigure	Boolean	true, false	No
l3_virtual_networks	List	String	No
l2_virtual_networks	List	[l2_virtual_networks]	No
anycast_gateways	List	[anycast_gateways]	No
wireless_ssids	List	[wireless_ssids]	No
fabric_zones	List	[fabric_zones]	No
multicast	Class	[multicast]	No

authentication_template (catalyst_center.fabric.fabric_sites)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes	No Authentication
dot1x_to_mab_fallback_timeout	Integer	min: 3, max: 120	No
wake_on_lan	Boolean	true, false	No
number_of_hosts	Choice	Unlimited, Single	No
bpdu_guard	Boolean	true, false	No
authentication_order	Choice	mac, dot1x	No
pre_auth_acl	Class	[pre_auth_acl]	No

l2_virtual_networks (catalyst_center.fabric.fabric_sites)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
vlan_name	String		No
vlan_id	Integer	min: 2, max: 4093	No
traffic_type	Choice	DATA, VOICE	No
fabric_enabled_wireless	Boolean	true, false	No
associated_l3_virtual_network_name	String		No

anycast_gateways (catalyst_center.fabric.fabric_sites)

Name	Type	Constraint	Mandatory	Default Value
ip_pool_name	String		Yes
pool_type	Any	Choice[EXTENDED_NODE, FABRIC_AP] or Null	No
auto_generate_vlan_name	Boolean	true, false	No	false
vlan_name	String		No
vlan_id	Integer	min: 2, max: 4093	No
security_group_name	String		No
ip_directed_broadcast	Boolean	true, false	No	false
intra_subnet_routing_enabled	Boolean	true, false	No	false
multiple_ip_to_mac_addresses	Boolean	true, false	No	false
supplicant_based_extended_node_onboarding	Boolean	true, false	No
group_based_policy_enforcement_enabled	Boolean	true, false	No
layer2_flooding	Boolean	true, false	No	false
traffic_type	Choice	DATA, VOICE	No	DATA
critical_pool	Boolean	true, false	No	false
wireless_pool	Boolean	true, false	No	false
tcp_mss_adjustment	Integer	min: 500, max: 1440	No
l3_virtual_network	String		No

wireless_ssids (catalyst_center.fabric.fabric_sites)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
vlan_name	String		Yes
security_group_name	String		No

fabric_zones (catalyst_center.fabric.fabric_sites)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
authentication_template	Class	[authentication_template]	No
l3_virtual_networks	List	String	No
anycast_gateways	List	String	No
l2_virtual_networks	List	String	No

multicast (catalyst_center.fabric.fabric_sites)

Name	Type	Constraint	Mandatory	Default Value
replication_mode	Choice	NATIVE_MULTICAST, HEADEND_REPLICATION	No
virtual_networks	List	[virtual_networks]	No

pre_auth_acl (catalyst_center.fabric.fabric_sites.authentication_template)

Name	Type	Constraint	Mandatory	Default Value
enabled	Boolean	true, false	No
implicit_action	Choice	DENY, PERMIT	No
description	String		No
access_contracts	List	[access_contracts]	No

virtual_networks (catalyst_center.fabric.fabric_sites.multicast)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
ip_pool_name	String		Yes
ipv4_ssm_ranges	List	String	No
ipv6_ssm_ranges	List	String	No
multicast_rps	List	[multicast_rps]	No

access_contracts (catalyst_center.fabric.fabric_sites.authentication_template.pre_auth_acl)

Name	Type	Constraint	Mandatory	Default Value
action	Choice	PERMIT, DENY	Yes
port	Choice	domain, bootpc, bootps	Yes
protocol	Choice	TCP, UDP, TCP_UDP	Yes

multicast_rps (catalyst_center.fabric.fabric_sites.multicast.virtual_networks)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
rp_location	Choice	FABRIC, EXTERNAL	Yes
ipv4_address	IP		No
ipv6_address	IP		No
is_default_v4_rp	Boolean	true, false	No
is_default_v6_rp	Boolean	true, false	No
fabric_rps	List	String	No
ipv4_asm_ranges	List	String	No
ipv6_asm_ranges	List	String	No

Fabric Sites define the SD-Access fabric boundary within the site hierarchy. Enabling a site as a fabric site activates Software-Defined Access functionality including micro-segmentation, policy enforcement, and automated underlay/overlay provisioning. Fabric sites contain Border Devices, Virtual Networks, Anycast Gateways, and Port Assignments. This resource is SDA fabric only.

Examples

Example-1: Basic Fabric Site with No Authentication

This example demonstrates how to configure a basic SD-Access fabric site in Catalyst Center with no authentication requirements. Fabric sites enable Software-Defined Access functionality within designated network areas, providing centralized policy enforcement and micro-segmentation capabilities.

The fabric site configuration includes:

• Site hierarchy specification (Global/Canada) for geographic and organizational structure
• Authentication template assignment (No Authentication) for simplified initial deployment
• Foundation for SD-Access fabric enablement without immediate authentication requirements
• Base configuration suitable for proof-of-concept or laboratory environments

---
catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Canada
        authentication_template:
          name: No Authentication
        pub_sub_enabled: true

Example-2: Campus Fabric Site with Closed Authentication

This example demonstrates how to configure a campus fabric site with closed authentication mode for high-security environments where all network access requires explicit authentication and authorization.

---
catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Canada
        authentication_template:
          name: Closed Authentication
        pub_sub_enabled: true

Example-3: Multi-Site Fabric Deployment

This example shows how to configure multiple fabric sites across different geographic locations, each with appropriate authentication templates based on local security requirements and organizational policies.

---
catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/North_America/New_York_Office
        authentication_template:
          name: Closed Authentication
        pub_sub_enabled: true


      - name: Global/Asia_Pacific/Tokyo_Branch
        authentication_template:
          name: Open Authentication
        pub_sub_enabled: true

      - name: Global/Europe/London_Office
        authentication_template:
          name: Low Impact
        pub_sub_enabled: true


      - name: Global/Americas/Mexico_City_Branch
        authentication_template:
          name: No Authentication
        pub_sub_enabled: true

Example-4: Fabric Site custom authentication template

This example demonstrates how to configure a fabric site with custom options for authentication templates

---
catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Corporate/London_Office
        authentication_template:
          name: Closed Authentication
          dot1x_to_mab_fallback_timeout: 30
          wake_on_lan: false
          number_of_hosts: Unlimited
          authentication_order: dot1x
          bpdu_guard: false
        pub_sub_enabled: true


     - name: Global/Corporate/Tokyo_Branch
        authentication_template:
        authentication_template:
          name: Low Impact
          dot1x_to_mab_fallback_timeout: 30
          wake_on_lan: false
          number_of_hosts: Unlimited
          authentication_order: mac
          bpdu_guard: false
          pre_auth_acl:
            enabled: true
            implicit_action: PERMIT
            access_contracts:
              - action: PERMIT
                port: domain
                protocol: UDP
              - action: PERMIT
                port: bootpc
                protocol: UDP
              - action: PERMIT
                port: bootps
                protocol: UDP
        pub_sub_enabled: true

Example-5: Fabric Site configuration with fabric zones

This example demonstrates how to configure a fabric site that has a fabric zone

Caution

In the devices yaml file, the Edge device that will be part of the fabric zone, is configured with a fabric_zone element matching the fabric zone name

---
catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Poland/Bytom
        authentication_template:
          name: Closed Authentication
          dot1x_to_mab_fallback_timeout: 30
          wake_on_lan: false
          number_of_hosts: Unlimited
          authentication_order: dot1x
        pub_sub_enabled: false
        l2_virtual_networks:
          - name: L2_SDA_VN_1
            vlan_name: L2_VLAN_USERS
            vlan_id: 455
            traffic_type: DATA
            fabric_enabled_wireless: false
          - name: L2_VN
            vlan_name: L2VN_VLAN
            traffic_type: DATA
            fabric_enabled_wireless: false
        l3_virtual_networks:
          - SDA_VN_USERS
          - SDA_VN_PRINTERS
          - SDA_VN_CORPORATE
          - INFRA_VN
        anycast_gateways:
          - ip_pool_name: Campus
            vlan_name: Campus_VLAN
            traffic_type: DATA
            l3_virtual_network: SDA_VN_USERS
            wireless_pool: true
          - ip_pool_name: Voice
            vlan_name: Voice_VLAN
            vlan_id: 224
            traffic_type: VOICE
            l3_virtual_network: SDA_VN_USERS
          - ip_pool_name: AP
            pool_type: FABRIC_AP
            vlan_name: AP_VLAN
            vlan_id: 225
            traffic_type: DATA
            l3_virtual_network: INFRA_VN

        fabric_zones:
          - name: Global/Poland/Bytom/Bld_B
            authentication_template:
              name: No Authentication
            l3_virtual_networks:
              - SDA_VN_USERS
            l2_virtual_networks:
              - L2_SDA_VN_1
            anycast_gateways:
              - Campus


  inventory:
    devices:
      - name: LAN-EN2
        fqdn_name: LAN-EN2.cisco.eu
        device_ip: 181.1.1.43
        pid: C9KV-UADP-8P
        state: PROVISION
        device_role: ACCESS
        site: Global/Poland/Bytom/Bld_B
        fabric_zone: Global/Poland/Bytom/Bld_B
        fabric_roles:
          - EDGE_NODE

Example 6: Fabric Site Reconfiguration

When the IPv4 pool used by a Fabric site is modified, for example when DHCP or DNS server information is updated, the Fabric becomes out of date. The site must be re-provisioned so that the changes take effect.

Cisco Catalyst Center displays a warning on the Fabric site indicating that a reconfiguration is required.

Caution

You modified the IP pools used by this Fabric. The Fabric is now out of date. To update, select Reconfigure Fabric. The update time depends on the number of devices. To trigger the reconfiguration through the Data Model, add the field “reconfigure: true” under the Fabric site configuration.

---
catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Poland/Krakow
        reconfigure: true